What is the CVSS score of EUVD-2026-37473?

EUVD-2026-37473 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Elementra Theme are affected by EUVD-2026-37473?

WordPress sites running the Elementra theme through version 1.0.9 face critical risk of unauthenticated remote code execution, potentially enabling complete site compromise and data breach.

How to fix or mitigate EUVD-2026-37473?

24 hours: Inventory all WordPress deployments and identify those running Elementra theme ≤1.0.9; disable the theme or restrict access to trusted networks only. 7 days: Implement Web Application Firewall (WAF) rules blocking PHP object deserialization patterns; evaluate alternative themes and begin migration planning. 30 days: Complete theme replacement; monitor vendor advisories for patch release; conduct security audit of affected sites for unauthorized access.

Elementra Theme EUVD-2026-37473

| CVE-2026-39529 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-16 Patchstack

PHP Deserialization Elementra

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable deserialization in a WordPress theme yields PR:N, AV:N, AC:L, UI:N; successful object injection typically enables RCE giving full C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:40 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions.

AnalysisAI

Unauthenticated PHP object injection in the WordPress Elementra theme (versions ≤ 1.0.9) allows remote attackers to deliver crafted serialized payloads that trigger deserialization of untrusted data. With no public exploit identified at time of analysis, the CVSS 9.8 vector still indicates network-reachable, no-auth exploitation against any WordPress site running an affected Elementra build. Successful chaining with a POP gadget in WordPress core or other installed plugins typically yields remote code execution or full site compromise.

Technical ContextAI

Elementra is a commercial WordPress theme published by themerex_group (CPE cpe:2.3:a:themerex_group:elementra). The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data): PHP code somewhere in the theme passes attacker-controllable input to unserialize() (or an equivalent sink such as maybe_unserialize), instantiating arbitrary objects whose magic methods (__wakeup, __destruct, __toString) execute during teardown. Because WordPress core and many popular plugins ship known POP (property-oriented programming) gadget chains, even a single injection point in a theme typically suffices to reach file write, SQL, or command execution sinks without the theme itself containing the dangerous code.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack advisory at https://patchstack.com/database/wordpress/theme/elementra/vulnerability/wordpress-elementra-theme-1-0-9-php-object-injection-vulnerability lists affected versions ≤1.0.9 without naming a fixed release, so administrators should monitor themerex_group for a version above 1.0.9 and apply it as soon as it ships. In the interim, the most effective compensating control is to deactivate and remove the Elementra theme and switch to a different theme (trade-off: site appearance and theme-specific shortcodes will break); if removal is not feasible, deploy a WAF rule (Patchstack, Wordfence, or equivalent) to block requests containing serialized PHP payload markers such as 'O:' followed by a class name and ':{' against theme endpoints, accepting that false positives are possible on legitimate serialized cookies or form data. Restricting public access to AJAX, REST, or admin-ajax endpoints exposed by the theme via IP allowlists is a further hardening step where business requirements allow.